CVE-2026-15779: 
Samba vulnerability analysis and mitigation

CVE-2026-15779 is a flaw in Samba's pam_winbind module where, when mkhomedir is enabled, the module calls chown() on a target account's home directory without validating that the path is not a critical system directory such as /. This can cause the root filesystem ownership to change to a non-privileged account's UID/GID, resulting in severe denial of service. The vulnerability affects samba-winbind packages in the 4.19.x and 4.23.x series (as shipped with RHEL 8 and RHEL 9.x prior to 9.9); RHEL 9.9 and 10.3 shipping samba 4.24.3 are not affected. It was disclosed on July 14–15, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource). The vulnerable code path resides in _pam_mkhomedir() / _pam_chown_homedir() within nsswitch/pam_winbind.c, which calls chown() on pw_dir (taken directly from getpwnam()) without first verifying the path is not a sensitive system directory. On RHEL, several stock system accounts (e.g., nobody, sssd, nscd) have / as their default home directory in /etc/passwd. Exploitation requires local access with low privileges — specifically, a non-root user holding a narrow sudo delegation (e.g., someuser ALL=(nobody) NOPASSWD: ...) can trigger the vulnerable PAM code path via the shared system-auth PAM stack, causing / to be chown'd to the target account's UID/GID. The upstream fix in samba 4.24.3 refactored the logic so chown() only fires when mkdir() creates a genuinely new directory, not when the target already exists (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation changes the ownership of the root filesystem (/) to a non-privileged account's UID/GID, breaking ownership checks relied upon by sshd (StrictModes), sudo, and package management tooling, resulting in severe denial of service. Because / ships with restrictive 0555 permissions on RHEL, the ownership change does not grant write access to the filesystem, so arbitrary file creation or privilege escalation via filesystem writes is not possible. The impact is therefore limited to availability loss — specifically, SSH login failures, sudo breakage, and package manager failures — rather than confidentiality or full integrity compromise (Red Hat Bugzilla, Red Hat CVE).

1. Reconnaissance: Identify a target RHEL 8 or RHEL 9 (pre-9.9) system with samba-winbind installed and mkhomedir = yes set in pam_winbind.conf.
2. Identify vulnerable accounts: Check /etc/passwd for system accounts (e.g., nobody, sssd, nscd) whose home directory (pw_dir) is set to /.
3. Leverage sudo delegation: As a non-root user with a narrow sudo delegation such as someuser ALL=(nobody) NOPASSWD: /bin/bash, run a command as the target account (e.g., sudo -u nobody /bin/bash).
4. Trigger PAM session: The sudo invocation traverses the shared system-auth PAM stack, which invokes pam_winbind's _pam_mkhomedir() / _pam_chown_homedir() functions.
5. Root filesystem chown: Without path validation, chown() is called on / (the account's pw_dir), changing ownership of the root filesystem to the nobody account's UID/GID.
6. Denial of service achieved: Subsequent sshd (StrictModes), sudo, and package manager operations fail due to broken ownership checks on / (Red Hat Bugzilla).

• Logs: sshd log entries showing StrictModes failures or refusal to accept connections; sudo log entries showing permission errors unrelated to policy; PAM session logs referencing pam_winbind and mkhomedir for system accounts like nobody.
• File System: Output of ls -la / showing owner changed from root to a non-root account (e.g., nobody); stat / reporting UID/GID other than 0:0.
• Process: Unexpected sudo invocations as system accounts (e.g., nobody, sssd, nscd) visible in process listings or audit logs (/var/log/audit/audit.log showing syscall=chown on path / by a non-root process).

Red Hat has queued non-security bug-fix errata for affected releases: RHEL 8.10.z (via RHBA-2026:169544, publishing 2026-07-28), RHEL 9.8.z (via RHBA-2026:168497, publishing 2026-08-04), and RHEL 10.2.z (via RHBA-2026:168496, publishing 2026-08-04). RHEL 9.9 and RHEL 10.3 shipping samba 4.24.3 are not affected and require no action. As an immediate workaround, administrators should disable mkhomedir in pam_winbind.conf (mkhomedir = no) or ensure no system accounts with / as their home directory are reachable via PAM sessions triggered by sudo delegations. Auditing /etc/passwd to correct home directories for system accounts (e.g., changing nobody's home from / to /nonexistent) also mitigates the risk (Red Hat Bugzilla, Red Hat CVE).